From d44e1f6fbb46a9565ed5a6da5b4732e11a03ecef Mon Sep 17 00:00:00 2001
From: Daniele De Lorenzi <daniele.delorenzi@sysdig.com>
Date: Wed, 20 Sep 2023 07:54:14 -0400
Subject: [PATCH] feat(cluster-scanner): Introduce support to external secrets
 accessKeySecret (#1287)

Signed-off-by: Daniele De Lorenzi <daniele.delorenzi@sysdig.com>
---
 charts/cluster-scanner/Chart.yaml             |  2 +-
 charts/cluster-scanner/README.md              |  8 ++--
 charts/cluster-scanner/templates/_helpers.tpl |  9 +++++
 .../cluster-scanner/templates/deployment.yaml | 10 +++++
 charts/cluster-scanner/templates/secret.yaml  |  2 +
 .../tests/existing-secret_test.yaml           | 38 +++++++++++++++++++
 6 files changed, 64 insertions(+), 5 deletions(-)
 create mode 100644 charts/cluster-scanner/tests/existing-secret_test.yaml

diff --git a/charts/cluster-scanner/Chart.yaml b/charts/cluster-scanner/Chart.yaml
index 0317a8c0d..61e68feb7 100644
--- a/charts/cluster-scanner/Chart.yaml
+++ b/charts/cluster-scanner/Chart.yaml
@@ -4,7 +4,7 @@ description: Sysdig Cluster Scanner
 
 type: application
 
-version: 0.5.5
+version: 0.5.6
 
 appVersion: "0.1.0"
 home: https://www.sysdig.com/
diff --git a/charts/cluster-scanner/README.md b/charts/cluster-scanner/README.md
index 3fc3fa507..d4855f0f9 100644
--- a/charts/cluster-scanner/README.md
+++ b/charts/cluster-scanner/README.md
@@ -25,7 +25,7 @@ $ pre-commit run -a
 $ helm repo add sysdig https://charts.sysdig.com
 $ helm repo update
 $ helm upgrade --install sysdig-cluster-scanner sysdig/cluster-scanner \
-      --create-namespace -n sysdig --version=0.5.5  \
+      --create-namespace -n sysdig --version=0.5.6  \
       --set global.clusterConfig.name=CLUSTER_NAME \
       --set global.sysdig.region=SYSDIG_REGION \
       --set global.sysdig.accessKey=YOUR-KEY-HERE
@@ -55,7 +55,7 @@ To install the chart with the release name `cluster-scanner`, run:
 
 ```console
 $ helm upgrade --install sysdig-cluster-scanner sysdig/cluster-scanner \
-       --create-namespace -n sysdig --version=0.5.5 \
+       --create-namespace -n sysdig --version=0.5.6 \
        --set global.clusterConfig.name=CLUSTER_NAME \
        --set global.sysdig.region=SYSDIG_REGION \
        --set global.sysdig.accessKey=YOUR-KEY-HERE
@@ -161,7 +161,7 @@ Specify each parameter using the **`--set key=value[,key=value]`** argument to `
 
 ```console
 $ helm upgrade --install sysdig-cluster-scanner sysdig/cluster-scanner \
-    --create-namespace -n sysdig --version=0.5.5 \
+    --create-namespace -n sysdig --version=0.5.6 \
     --set global.sysdig.region="us1"
 ```
 
@@ -170,7 +170,7 @@ installing the chart. For example:
 
 ```console
 $ helm upgrade --install sysdig-cluster-scanner sysdig/cluster-scanner \
-    --create-namespace -n sysdig --version=0.5.5 \
+    --create-namespace -n sysdig --version=0.5.6 \
     --values values.yaml
 ```
 
diff --git a/charts/cluster-scanner/templates/_helpers.tpl b/charts/cluster-scanner/templates/_helpers.tpl
index 84cf06f2e..9836c057c 100644
--- a/charts/cluster-scanner/templates/_helpers.tpl
+++ b/charts/cluster-scanner/templates/_helpers.tpl
@@ -261,3 +261,12 @@ Return local registry secrets in the correct format: <namespace_name>/<secret_na
     {{- end -}}
     '{{- join "," $list -}}'
 {{- end -}}
+
+{{- define "cluster-scanner.accessKeySecret" -}}
+    {{/*
+    Note: the last default function call is to avoid some weirdness when either
+    argument is nil. If .Values.global.sysdig.accessKeySecret was undefined, the
+    returned empty string does not evaluate to empty on Helm Version:"v3.8.0"
+    */}}
+    {{- .Values.global.sysdig.accessKeySecret | default "" -}}
+{{- end -}}
diff --git a/charts/cluster-scanner/templates/deployment.yaml b/charts/cluster-scanner/templates/deployment.yaml
index 21abcd57d..0ce6a527e 100644
--- a/charts/cluster-scanner/templates/deployment.yaml
+++ b/charts/cluster-scanner/templates/deployment.yaml
@@ -258,8 +258,13 @@ spec:
           - name: SYSDIG_ACCESS_KEY
             valueFrom:
               secretKeyRef:
+                {{- if not ( include "cluster-scanner.accessKeySecret" . ) }}
                 name: {{ include "cluster-scanner.fullname" . }}
                 key: sysdig_access_key
+                {{- else }}
+                name: {{ ( include "cluster-scanner.accessKeySecret" . ) }}
+                key: access-key
+                {{- end }}
           - name: NATS_JS_SERVER_PASSWORD
             valueFrom:
               secretKeyRef:
@@ -354,8 +359,13 @@ spec:
           - name: SYSDIG_ACCESS_KEY
             valueFrom:
               secretKeyRef:
+                {{- if not ( include "cluster-scanner.accessKeySecret" . ) }}
                 name: {{ include "cluster-scanner.fullname" . }}
                 key: sysdig_access_key
+                {{- else }}
+                name: {{ ( include "cluster-scanner.accessKeySecret" . ) }}
+                key: access-key
+                {{- end }}
           - name: SYSDIG_API_URL
             valueFrom:
               configMapKeyRef:
diff --git a/charts/cluster-scanner/templates/secret.yaml b/charts/cluster-scanner/templates/secret.yaml
index 1d21f3fe3..59c792d71 100644
--- a/charts/cluster-scanner/templates/secret.yaml
+++ b/charts/cluster-scanner/templates/secret.yaml
@@ -7,7 +7,9 @@ metadata:
     {{- include "cluster-scanner.labels" . | nindent 4 }}
 type: Opaque
 data:
+{{- if not ( include "cluster-scanner.accessKeySecret" . ) }}
   sysdig_access_key: {{ required "please provide a sysdig access key" .Values.global.sysdig.accessKey | b64enc | quote }}
+{{- end }}
   js_server_password: {{ .Values.runtimeStatusIntegrator.natsJS.password | default (randAlphaNum 32) | b64enc | quote }}
 {{- if and (eq .Values.imageSbomExtractor.cache.type "distributed") ((.Values.imageSbomExtractor.cache.redis).password) }}
   cache_redis_password: {{ .Values.imageSbomExtractor.cache.redis.password | b64enc | quote }}
diff --git a/charts/cluster-scanner/tests/existing-secret_test.yaml b/charts/cluster-scanner/tests/existing-secret_test.yaml
new file mode 100644
index 000000000..3874a2c87
--- /dev/null
+++ b/charts/cluster-scanner/tests/existing-secret_test.yaml
@@ -0,0 +1,38 @@
+---
+suite: existing-secret
+templates:
+  - ../templates/deployment.yaml
+  - ../templates/clusterrole.yaml
+  - ../templates/clusterrolebinding.yaml
+  - ../templates/role.yaml
+  - ../templates/rolebinding.yaml
+  - ../templates/configmap.yaml
+  - ../templates/secret.yaml
+values:
+  - ../values.yaml
+release:
+  name: test-release
+  namespace: test-ns
+tests:
+  - it: "External secret env is set"
+    templates:
+      - ../templates/deployment.yaml
+    set:
+      global.sysdig.accessKeySecret: "secret"
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].env[35]
+          value:
+            name: SYSDIG_ACCESS_KEY
+            valueFrom:
+              secretKeyRef:
+                key: access-key
+                name: secret
+      - equal:
+          path: spec.template.spec.containers[1].env[8]
+          value:
+            name: SYSDIG_ACCESS_KEY
+            valueFrom:
+              secretKeyRef:
+                key: access-key
+                name: secret